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Abstract 

While powerful tools have been developed to analyze quantum query complexity, there are 
still many natural problems that do not fit neatly into the black box model of oracles. We create 
a new model that allows multiple oracles with differing costs. This model captures more of the 
difficulty of certain natural problems. We test this model on a simple problem, Search with Two 
Oracles, for which we create a quantum algorithm that we prove is asymptotically optimal. We 
further give some evidence, using a geometric picture of Grover’s algorithm, that our algorithm 
is exactly optimal. 


1 Introduction 

The standard oracle model is a powerful paradigm for understanding quantum computers. Tools 
such as the adversary semidefinite program [12, 13], learning graphs [5, 6], and the polynomial 
method [4] allow us to accurately characterize the quantum query complexity [1, 7] of many prob¬ 
lems of interest. 

However, the oracle model does not capture the full power or challenges of quantum computing. 
For example, problems such as h-SAT do not fit easily into the oracle model. Additionally, while 
the query complexity of the hidden subgroup problem is known to be polynomial in the size of the 
problem [11], for some non-abelian groups there is no efficient algorithm. 

In this paper, we describe a variation of the oracle model. We have access to two oracles, rather 
than a single oracle^, but one oracle is more expensive to use. In the standard oracle model, the 
figure of merit is the query complexity, which is the minimum number of queries needed to an 
oracle to evaluate a function. In our model, the figure of merit is the cost complexity, which is the 
minimum cost needed to evaluate a function using multiple oracles with different costs. 

To motivate this model, we consider the following fact: in some search problems we want to 
find an element in a set that satisfies a property that is expensive to test. However, often another 
less expensive test is available that can narrow down the search range but is not conclusive. We 
give three examples of problems where such less expensive, less conclusive tests are natural. In 
each example, Test 1 is more expensive to run but is conclusive, while Test 2 is cheaper to run but 
allows some non-solutions to pass. 

• In the problem of h-SAT on n bits, we would like to find an assignment x G {0,1}*^ such that 
all clauses are satisfied. Consider an algorithm for /c-SAT that runs two types of tests on a 
possible assignment x: 

^The model can easily be extended to more than two oracles, but for simplicity, we limit ourselves to two. 
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1. Check whether all clauses are satisfied. 

2. Check whether some subset of the clauses are satisfied. 

• Given a graph A and a set of graphs {Bi, ■ ■ ■ , Bp}, we would like to find a graph Bi isomorphic 
to A. Consider an algorithm that runs two types of tests on a graph Bf. 

1. Check whether Bi is isomorphic to A (say by brute force search). 

2. Check whether the adjacency matrices of Bi and A have the same spectrum. 

• In the decision variant of the traveling salesman problem, given a positively weighted A^-graph 
G and a positive number b, we would like to find a tour of the vertices of G that uses cost no 
more than b. Given a partial tour of length N/2, we can run two types of tests: 

1. Check whether the partial tour can be completed to an AI-vertex tour that has cost at 
most b, by using brute force search. 

2. Check whether the sum of the weights of the N/2 edges traversed in the partial tour is 
bigger than b. 

In all three examples, the two tests can be implemented as unitaries Oi, O 2 that act as Oi\x)\y) = 
|x)|y © fi{x)). Here fi{x) = 1 if assignment x passes Test i and fi{x) = 0 otherwise. These two 
unitaries will play the role of oracles with different costs. 

None of the problems listed above are typically thought of as oracle problems, because in 
each problem, there is more information than can easily be incorporated into a single oracle. 
However, with multiple oracles, the information can be distributed among different oracles. Using 
different costs for different oracles allows us to include information about the time required to access 
information. We see that cost complexity can capture certain aspects of a problem that can not be 
easily accounted for in the standard oracle model; we hope this model will provide new insight into 
problems previously thought beyond the tools of query algorithms. We note that we do not expect 
these techniques to allow us to solve NP-complete problems in polynomial time. Rather, our goal is 
to potentially improve upon existing exponential time algorithms, and create connections between 
standard oracle problems and problems that seem far from typical oracle problems. 

Problems such as those described above can easily be recast into an oracle problem, which we 
call Search with Two Oracles (STO). In this work, we focus on the problem of STO. We tightly 
characterize the quantum cost complexity of this problem, and give several techniques for putting 
lower bounds on quantum cost complexity. We also show that the cost complexity of STO is the 
same whether or not the oracles can be accessed using a control operation; that is, accessing the 
oracles in superposition gives no added power. 

We also attempt to exactly bound (rather than asymptotically bound) the cost complexity of 
STO. Usually, one is not particularly interested in proving exact optimality, but we have several 
reasons for wanting to explore this problem. Few quantum algorithms are known to be exactly 
optimal; Grover’s algorithm and parity are two examples [10, 4]. STO is a very simple extension of 
a standard search problem, so it seems like a good candidate problem for obtaining another exact 
lower bound. Proving that our algorithm is exactly optimal would provide evidence that amplitude 
amplification is exactly optimal in the case of no additional structure (i.e. when we treat the base 
algorithm as a black box). Additionally, while we can obtain asymptotically tight bounds for the 
problem of STO, for a simple extension of STO to log AI oracles (where N is the size of the search 
space), these techniques fail. However, if we could obtain tighter bounds for STO, we should be 
able to get a better characterization of the cost complexity for these more complex problems. 
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Finally, we compare the quantum cost complexity of STO to the classical cost complexity. 
We show a polynomial reduction in cost for the quantum version. Moreover, we show that the 
optimal quantum and classical algorithms behave qualitatively differently, highlighting the power 
of quantum algorithms. 

In Section 2, we describe cost complexity and define STO. In Section 3, we describe optimal 
quantum algorithms for STO, and in Section 4, we put lower bounds on the cost complexity of 
STO. Finally, we look at the classical cost complexity of STO in Section 5. 

2 Cost Complexity, STO, and Relation to Previous Work 

Cost complexity is very closely related to query complexity. For background on query complexity, 
see [1, 7]. 

We first define cost complexity. In the following, we use the notation [N] = {1,..., V}. Given 
the input (/i,/ 2 ) £ D, which is a pair of functions /i ,/2 : [N] —)■ {0,1}, we want to calculate 
F where F : D ^ {0,1}. Let fi be associated with cost ci and /2 be associated with cost C 2 . 
Depending on the type of algorithm (e.g. classical, quantum), these two functions are accessed in 
different ways. 

In the classical setting, consider a randomized classical algorithm Ac for F that makes qi queries 
to /i, and q 2 queries to f 2 - Then the cost of this algorithm is 

Cost(A) = qici + q2C2- ( 1 ) 

Let J^c,e be the set of randomized classical algorithms that solve F with success probability at least 
1 — e on all inputs in D. Then the classical randomized cost complexity (RCC) of F is 

RCCe{F) = min Cost(.Ac). (2) 

In the quantum setting, let Oi and O 2 be unitaries acting on the Hilbert space C'^ with standard 
basis states |i) for i G [A^] as Oj\i) = (—l)LL)|f) for j G 1,2. Consider a quantum algorithm Aq 
that at each time step, can apply Oi or O 2 or some other unitary that is independent of /i and / 2 , 
and which makes qi queries to Oi and q 2 queries to O 2 . Then the cost of the algorithm Aq is 

Cost(.Ag) = qici + q 2 C 2 . (3) 

Let s^q^c be the set of quantum algorithms that solve F with success probability at least 1 — e on 
all inputs in D. Then the quantum cost complexity (QCC) of F is 

QCCc{F) = min Cost(^„). (4) 

Finally, we consider quantum algorithms that can access oracles in superposition. Let Oi and 
O 2 be as above, and let Og = I, the N x N identity matrix. We now consider a quantum algorithm 
that has access to a controlled operation CO that acts on the the Hilbert space (8> (8> (C^ 

is a workspace register) with standard basis states |6)|i)|r;) for i G [N], v G [V], and b G {0,1,2} 
as CO\b,i) = \b)Oi,\i)\v). Suppose the encoded functions are /i and f 2 - Then if an algorithm Aqs 
applies CO a. total of T times over the course of the algorithm to states 

2 N V 

H 1 J 2 ) = J2J2J2^hj2(^C,v)\b,i,v) (5) 

b=0 i=l v=l 
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for f £ [T], the cost of the algorithm is 


T 

Cost(^gs) = max^K(r/l f^) where 
/1./2 



fci if Ei,,; 7^0, 

I C2 if J2i,v l«/i,/2(l>h'^)l^ = 0 and J2i,v l«/i,/ 2 ( 2 ’ + 0, 
[o if Y.i,v l«/i,/ 2 (^’h^)l^ = 0 and E*,^ l“/i,/ 2 ( 2 ’h= 0. 


( 6 ) 


Let s^qs^e be the set of quantum algorithms using CO that solve F with success probability at least 
1 — e on all inputs in D. Then the controlled quantum cost complexity (ConQCC) of F is 


ConQCCe{F) = min Cost(^qs)- (7) 

•^qs ^’^qs,€ 

The controlled quantum cost complexity is closely related to the time required in the model of 
variable times introduced by Ambainis in [2]. 

Note that 


ConQCC,{F) < QCC,{F) < RCC,{F). (8) 

For any of the cost complexities described above, if we do not include a subscript e, then the 
cost is assumed to apply for the case e = 1/3. 

Now that we have defined cost complexity, we introduce the problem of STO as a testbed for 
tools and ideas that can hopefully be applied to more complex problems. More formally, we give 
the definition of STO: 

Definition 1 (Search with Two Oracles (STO)). Let N and M he known positive integers and let 
S C [N] be an unknown set. There might or might not exist a speeial item F. If i^ exists, then one 
is promised that i,, € S and |5| = M. If F doesn’t exist, the size of S is arbitrary. Let /* and fs 
be two funetions with domain [A^] and range {0,1} sueh that 

1 if i = F 

0 if i ^ i^ or A doesn’t exist. 

Then STO{f^,, fs) = 1 if i* exists, and 0 otherwise, c* is the eost assoeiated with /* and cs is the 
eost assoeiated with fs, with c* > eg. 

cs and c* are assumed to depend on N and M, but our results hold for any form of that dependence, 
so we leave off any explicit relationship. 

Cost complexity, and STO in particular, are related to several existing oracle problems. In the 
problem of STO, the function fs can be thought of as providing extra information or advice about 
the function /*. There have been several studies in which access to a single oracle is supplemented 
with some extra information that can come in the form of another oracle or classical information, e.g. 
[14, 15]. Previous works [3, 14] have considered multiple oracles, but not with costs. Furthermore, 
the additional advice oracles considered in these works tend to be somewhat unnatural, and are 
tailored to the specific problems considered. As mentioned, ConQCC is related to the model of 
variable costs studied by Ambainis, in which he considered a single oracle that has different costs for 
querying different items [2]. We also note that Cerf et al. [9] consider similar quantum algorithms 
in the context of constraint satisfaction problems, but they do not approach the problem from an 
oracular perspective. 



fs{i) = 


1 ifi^S 
^0 ifi^S. 


(9) 
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3 Quantum Algorithms for STO 

We now describe quantum algorithms for solving STO^. These algorithms use the oracles O* and 
Os directly, rather than the controlled version (i.e. CO) of these oracles. All of our algorithms can 
be viewed as examples of amplitude amplification. Recall 

Theorem 1 (Amplitude Amplification [8]). Let T C [N], a G [0,1], and let O^ he an quantum 
oraele that marks the elements ofT. We define 

Given an algorithm A that aets on a state {fio) and produees a state {iPa) sueh that |(T'|V’^)| = p, 
one ean ereate a new algorithm B that applies A, and A~^ eaeh 

arcsin \/l — a — arcsin p 

T = - (11) 

2 arcsin p 

times, and whieh aets on the initial state {ipo) and produees a state ji/’g) sueh that 

IV-b) = vr^|r) +Vajr^), (12) 

where {T\T^) = 0 and \T^) G Span{\T), I^a))- 
This gives us the following Corollary: 

Corollary 2. Let A and r be as in Theorem 1, and assume O^ has eost ct while A and A~^ have 
eost CA- Then there exists a algorithm B that applies O^, A and A~^ not in superposition, and 
produees the state \T) with probability 1 — e sueh that 

Cost(R) = T (ct + 2c^). (13) 

In the following, we describe three algorithms for STO. We consider the limit that M, A^/M —)• oo 
to simplify our analysis, but this limit still captures the essential behavior of the algorithms. We 
use the following notation: 


We have a slight abuse of notation, since |A^) could refer either to the equal superposition state, 
or the standard basis state. However, whenever we write |A^), we will always mean the equal 
superposition state. 

The first algorithm we consider ignores Os and performs a Grover search for i* using Oa 

^For the purpose of describing these algorithms, we assume that i* exists. A single application of O, at the end 
of the algorithm can be used to check (with appropriate probability) whether or not i* exists, at a cost of c,. 
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Algorithm 1. (Grover’s Search) 

Prepare the state \N) at cost 0. Set A equal to the identity. Then by Corollary 2 there exists 
an algorithm B that produces the state |i*) with probability 1 — e with cost 


arcsin 


VI - e - 


arcsin 


Vn 


2 arcsin^ 


In the limit of iV —)■ oo, the cost becomes 


(15) 


arcsin Vi^Vn. 


(16) 


However, if Os comes to us cheaply, we would like to take advantage of it: The following 
algorithm first rotates \N) to IS") (using Os), and then rotates IS") to |i*) (using both Os and O*). 


Algorithm 2. 

Prepare the state \N) at cost 0. Set A equal to the identity. Since |(A|S')| = ^JM/N, by 
Corollary 2 there exists an algorithm B that with probability 1 produces the state \S) at cost 


cs 



2 — arcsin y ^ 


2 arcsin J ^ 


(17) 


Now Kills’)! = -y/T/M, so using Corollary 2 again, there exists an algorithm C that with probability 
1 — e produces the state |i*) at cost 


arcsin y/1 — e — arcsin 1 ^ 


2 arcsin^ 


c* + 2 c 5 


V 


2 — arcsin w ^ 


2 arcsin J ^ 


(18) 


Dropping terms of size at most 0(M ^/^) or O ^(M/A)^/^^ of the zeroth order terms, the cost 
becomes 


(2c^'/M + ttcs'/N^ . 


arcsin Vl — e 
4 

Combining Algorithms 1 and 2 , we have that 

QCC{STO) = O (min {c^ViV, c* Vm + csVn 
= O (max csVn 


(19) 


( 20 ) 


In Section 4, we will show that this cost (Eq. (20)) is asymptotically optimal. This means that 
Algorithm 2 is always asymptotically optimal, although Algorithm 1 has lower cost when c* ~ C 5 . 
However, it turns out that there is an algorithm that has lower cost than either Algorithm 1 or 2. 
In Section 4, we give evidence that this final algorithm, which we call the Hybrid Algorithm, is not 
just asymptotically optimal, but exactly optimal. 

The two algorithms we have so far presented can be summarized as follows: Algorithm 1 directly 
performs Grover rotations to rotate \N) to |i*), while Algorithm 2 first rotates \N) to \S), then 
rotates \S) to |i*). The final algorithm we consider, the Hybrid Algorithm, first rotates \N) to some 
superposition of \N) and \S), and then rotates to |i*). 
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Algorithm 3 (Hybrid Algorithm). 

Prepare the state \N) at cost 0. Set A equal to the identity. Since |(A|5)| = ^JM/N^ by 
Theorem 1 and Corollary 2 there exists an algorithm B that produces a state |V’b) at cost 


where 


cs 


arcsm 




— a — arcsin 



2 arcsin 



( 21 ) 




( 22 ) 


By Theorem 1, \S'^) is a linear combination of \S) and \N) but is orthogonal to IS"). Therefore, 
is a superposition of all elements not in S, and so = 0. Thus 




a 


y/M 


= (V’bIh 


(23) 


Applying Corollary 2 again, we can create an algorithm C that has cost 

/l—g 1 ( 


arcsm 


Vl - e - 


arcsm 


s/M 


2 arcsin 


/I —Q 

uw 


c* + 2 c5 


V 


^arcsin yjl — a — arcsin 
2 arcsin 


(24) 


and produces the state |i*) with probability 1 — e. In Appendix A, we show there is a choice of 
a such that, dropping terms of size at most 0(M“^/^) or 0{{M/Ny^‘^) that of the zeroth order 
terms, the cost is 


Cost (Hybrid) 


csVN arcsin ^/l 
2 


e 

- sec 



(25) 


where (popt is given by 


When Cs is close to c*, this algorithm approximates Algorithm 1. When cs is very small 
compared to c*, it approximates Algorithm 2. Otherwise, it, in effect, interpolates between the two 
algorithms. 


4 Lower Bound on Quantum Cost Complexity of STO 

Several techniques give asymptotically tight lower bounds on the quantum cost complexity of STO. 
We will briefly sketch two approaches for bounding the quantum cost complexity {QCC), and then 
discuss a bound on controlled quantum cost complexity (ConQCC) in detail. The fact that so 
many approaches give good lower bounds is encouraging; this means many techniques from (or 
variations on) the standard query complexity toolbox can be applied. 
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Our lower bound on ConQCC{STO) is asymptotically tight with the algorithms of Section 3, 
i.e. Eq. (20), even though those algorithms do not use controlled oracles. Because algorithms that 
use controlled versions of the oracles are more powerful than oracles that can not access controlled 
versions (see Eq. ( 8 )), this result proves that not only are our algorithms for STO asymptotically 
optimal, but having access to a controlled version of the oracles for STO does not give an advantage. 

When discussing lower bounds on the cost of STO, we will often refer to the SEARCH problem. 
We call SEARCH the problem in which one is given a function /* : [N] —)• {0,1} such that there 
is exactly zero or one element z* such that /*(i*) = 1 , and one would like to determine if there is 
such an element i*; in other words, SEARCH is computing OR(/*) with a promise on /*. 

Here are brief descriptions of two methods for lower bounding QCC. We describe them in the 
context of STO, but they could be applied more generally. 

Oracle Simulation: Suppose one only has an oracle O*. Then one could use this to simulate 
an oracle Os by applying O*, and then subsequently randomly choosing M — 1 items to mark. If 
M N, with high probability, the chosen M — 1 items will not include O*, and this simulated 
oracle will act identically to a true Os- Now any algorithm for STO that uses this simulated oracle 
will actually only use O* to find the marked item i*, and so the problem reduces to SEARCH. 
Well-known quantum lower bounds on SEARCH [7] then give a lower bound on the total number 
of queries to either O* or the simulated Os, which in turn can be used to put a lower bound on 
the cost. For more details on oracle simulation, see Section 5, in which we use oracle simulation to 
bound the classical cost complexity of STO. 

Adversary Method: One can create an adversary matrix whose rows and columns are indexed 
by pairs of oracles (/*, fs)- This matrix can be used to create a progress function, and then one can 
bound the progress that either oracle O* or Os can make. This gives lower bounds on the queries 
needed to O* and Os to evaluate STO, which in turn can be used to lower bound the cost of STO. 
In Appendix C, we detail how to create this bound for STO. 


4.1 Lower Bound on Controlled Qnantum Cost Complexity of STO 

In this section, in order to lower bound ConQCC{STO), we consider a new problem in the standard 
query model, which we call Expanded Search with Two Oracles (ESTO). We show that if we had an 
algorithm A which could use the control oracle CO to solve STO with cost Cyi, then we could create 
a new algorithm Al to solve ESTO using O(cyi) queries. We then use the adversary method to lower 
bound the query complexity of ESTO, which in turn puts a lower bound on ConQCC{STO). This 
strategy is inspired by Ambianis’s approach for lower bounding the variable times search problem 
[ 2 ]. 

We first describe the problem ESTO. We suggest referencing Figure 1 during the description 
of the problem for a graphical interpretation. Let N, M, c* and cs be as in STO. Without loss of 
generality, we can assume €*,05 S> 1. If they are not, we can multiply both costs by some large 
factor K. Then the final cost is exactly a factor of K larger than it would have been with the original 
costs. (If Cs = 0, this approach does not work, but in that case, STO reduces to SEARCH). We 
define 


m* = max < 

[- 

1 _ 

ms = max < 


1 _ 


Tl ^ cs,i GzI, 


ESTO queries an unknown function / : [N{ms+m^)] —)• {0,1}. We consider Di = {1,..., Nm^} 
to be the “first part” of the domain of /, and = {Am* -|- 1 ,..., N{m^ + ms)} to be the “second 






Di 2)2 




i 

12345 

67- 

i* 















no 

00000 

00000 

00100 

00000 

0001 

0000 

0100 

0000 


Figure 1: A diagram of a function / for which ESTO(/) = 1. The domain of / is divided into two 
parts Vi and T) 2 . Each of these sets are further divided into N sets of size m* and ms respectively. 
These sets are labeled 7^^ for sets in Vi , and for sets in 2?2 • We see there is exactly one value of 
i G 2?i with value 1, and it is in the set In the case shown in this figure, S = {!,/;:*}, so both 
and Ti contain exactly one marked item. 


part” of the domain. We further divide (T’ 2 ) into N blocks of m* {ms) elements respectively, 
where the elements 7^^ = {{k — l)m* +1,..., /cm*} constitute the /c*'^ block of Pi, and the elements 

= {Aim* + [k — l)ms + 1,..., Aim* + kms} constitute the k^^ block of V 2 . 

We are promised that there is either exactly zero or one value i* G Pi such that /(/*) = 1. If 
there is such an i*, we label the block it is in by /c*, so i* G Furthermore, if i* exists, there is 
a set S G [Ai] such that |5| = M, /c* G 5, and for each k G S there is exactly one value of i G 7}? 
such that f{i) = 1. Given such a function /, ESTO(/) = 1 if there is an item i* G Pi such that 
/(z*) = 1, and 0 otherwise. 

Given an algorithm A for STO that uses the control oracle CO and has cost c^, we can create 
an algorithm A' to solve ESTO that uses 2c^ queries. Let = 1 for 6 G {1, 2} if there is an 
element i G 7}-^ such that f(i) = 1, and 0 otherwise. Then by Glaim 2 in [2], there is an algorithm B 
that takes |5, j)|0)|0) —)■ |^,7)|yj)|V’j) for some state and uses c* queries if 6 = 1 and cs queries 
if 6 = 2. At the cost of doubling the number of queries, we can uncompute the final register. Thus 
there is an algorithm B' that takes |6, j)|0) —)■ \b,j)\yj) aird uses 2c* queries if 6 = 1 and 2c5 queries 
if 6 = 2. We also allow for 6 = 0, in which case the algorithm B' applies the identity. 

Then we can solve ESTO using our algorithm A for STO. In STO we are searching for a specific 
element i* G [Ai] with certain properties, in ESTO, the search is for a specific block k* G [Ai] with 
analogous properties. We replace an application of the controlled oracle C-O to the state j6, z) 
with 6 G {0,1,2} and z G [Ai] with an application of the algorithm B' to the state 16,z), (which 
corresponds to searching the block 7}^, for 6 G {1,2} and z G [Ai], or doing nothing if 6 = 0). The 
number of queries required by B' will be twice cost of the equivalent query made by A. Due to the 
specific structure of /, this algorithm will solve ESTO with a number of queries equal to 2cyi. 

Now all that is left is to put a lower bound on the number of queries needed to solve ESTO. 
We use Ambainis’s adversary bound: 

Theorem 3 (Basic Adversary Bound [1]). Let P(/(l),..., /(Ai)) be a funetion of N {0, l}-valued 
variables f{i), and let X, Y be two sets of inputs sueh that F{f) A Fid) if f G X and g G Y. Let 
R C X X Y be sueh that 

• For every f G X, there exist at least /z different g GY sueh that (/, g) G R. 

• For every g gY , there exist at least g' different f G X sueh that (/, g) G R. 
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• For every / G X and i G [N], there are at most I different g € Y sueh that {f,g) G R and 

f{i) 

• For every g G Yand i G [A^], there exist at least V different f G X sueh that {f,g) G R and 
Then, any quantum algorithm eomputing F with error at most e on all valid inputs uses at least 


1 -2\/e(l -e) /W 

2 V IV 


(27) 


queries. 

For the sets X and Y, we only consider functions / where in each block 7)^, there is at most 1 
marked item. We denote by fk,,u,s,S' ^ function where G T>i is the marked item, A:* is the block 
where the sits (or = /c* = 0 if there is no marked item in I?i), S' is the set of blocks in T >2 that 
have exactly one marked item in each block, and S' is a list of the |S| items that are marked in the 
second part of the domain. 

Let X be the set of all functions fk„,it,s,S' with /c* / 0, i* / 0, \S\ = M, and G S. From our 
definition of ESTO, these are functions for which the algorithm should output 1. Let Y be the set 
of functions /o,o,T,T' with \T\ = M — 1. Then R is defined by {fkt,u,s,SG /o,o,t,T') G i? if and only if 
T <Z S,T' <Z S', and A:* ^ T. With this definition of R, we have g = I while g' = [N — M + l)m^ms. 
Likewise I = 1 while I' = max{m 5 , m*} = m* since c* > cs- Theorem 3 then gives that the number 
of queries required to solve ESTO, is at least 

} (28) 

Eq. (28) does not tell the full story; we can repeat this procedure with the set X the same 
as before, but now the set Y includes all functions fo,o,s,S' such that l^l = M. Then we choose 
{fkt,u,S,SG fo,o,T,T') G 7? if and only if T = S' and T' = S' . With this definition of R, we have g = I, 
while g' = Mm^. Likewise I = 1 while I' = 1. Again using Theorem 3, we have that the number of 
queries required to solve ESTO is at least 

1 - 2 ^ 6(1 - ( 29 ) 

Since c*,C 5 S> 1, we have m* = 0((c*)^) and ms = ^((cg)^), so combining Eq. (28) and Eq. 
(29), and using the fact that a lower bound on the query complexity of ESTO gives a lower bound 
on the controlled quantum cost complexity of of STO, we have 


ConQCCe(STO) > ^ I x max | ^{N -M + l)ms'^ (30) 

= n ^max j-v/Mc*, {N — M + l)c5|^ . (31) 

With Eq. (20), this bound proves our algorithms are asymptotically optimal. In Eigure 2, we 
compare the bound given by the reduction to ESTO with the Hybrid Algorithm. Even though the 
functions are asymptotically tight, the forms of these two bounds are quite different. 
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Figure 2: The solid line is the cost of the hybrid algorithm, while the dashed line is the lower 
bound on the cost given by Eq. (30). The cost is calculated with c* = 1, iV = 10^, M = 400 and 
e = 0 while cg is varied. 


4.2 Exact Lower Bound for Cost Complexity of STO 

In the introduction, we mentioned several reasons for wanting to prove exact optimality of our 
algorithm for STO. Aside from finding an example besides Grover’s algorithm of an exactly optimal 
algorithm, proving our algorithm for STO is optimal would have several other implications. First, 
the algorithms described in Section 3 are all based on amplitude amplification, so if we can prove 
these approaches are optimal, that would give evidence that amplitude amplification is an exactly 
optimal algorithm for certain types of unstructured search problems. 

Second, if we consider an extension of STO to many oracles, we can no longer prove asymptotic 
optimality of our amplitude amplification algorithm. Note that in amplitude amplification, (see 
Theorem 1), the inner algorithm (A) is applied two times for each application of the oracle that 
identifies the target state (if A = This factor of two is not accounted for in our lower bound 

of Section 4.1. While this factor of two can be swept under the rug using asymptotic notation, 
if we consider a problem with k nested oracles, and try to apply a similar strategy as for STO 
and use nested amplitude amplification, the innermost algorithm will accumulate an extra factor 
of 2^ in the number of times it must be applied. Using a strategy similar to Section 4.1 to lower 
bound this problem will not catch that factor of 2^, for the same reason the factor of 2 is not 
characterized by the oracle simulation and adversary method. In the case oi k = logN nested 
oracles, our bounds will no longer be asymptotically tight. Thus, if we can find an exact bound 
in the case of STO, we might be able to extend it to get asymptotically tight bounds for the case 
of nested oracles, providing evidence that multiple nestings of amplitude amplification are optimal 
for certain problems. 

We have found that proving an exactly tight lower bound for STO is a challenge, and in fact 
we can only prove the hybrid algorithm is optimal in a limited setting. The difficulty in proving 
optimality even in this limited case provides insight into the difficulty of the more general case. 

The restricted setting we investigate is to only consider Grover-like algorithms. 

Definition 2. A Grover-like algorithm with oraeles {Oi,... ,Oi} that act on an N-dimensional 
Hilbert space must: 
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• Use only an N-dimensional Hilbert spaee as its workspaee, 

• Initialize in the equal superposition state |A^) = N); 

• Use only the unitaries {Oi,... ,Oi} and G = 1 — 2|A^)(iV| , and 

• End with a measurement on the standard basis. 


If we consider Grover-like algorithms for SEARCH, the state of the system is restricted to a 
2-dimensional subspace spanned by \N) and |r*). Since G^ = = I, the only possible algorithm is 

alternating G and O*, and one can easily track the progress of the state through the two dimensional 
space towards |i*), thus trivially proving that in this setting, Grover’s algorithm is exactly optimal. 

We will see in the proof of Theorem 4 that for STO, the picture becomes much more complicated. 
In fact, even in the restricted setting of Grover-like algorithms, we need an additional assumption 
to prove optimality. In particular, we show 

Theorem 4 (Exact Lower Bound). The cost of every Grover-like algorithm for STO that succeeds 
with probability at least 1 — e for a constant e is at least 




where (fopt satisfies 


(fopt = max 


0 , 


: tan 6 -|- 


^ M 
csV N- 


We also require the conditions M,N/M —>■ oo and C —?■ 0, where 

csVN 


G = 


c*\/e2M cos (4>opt + yjM/N^ 


(32) 


(33) 


(34) 


Theorem 4 matches the cost of our hybrid algorithm, Eq. (25). 

The proof of Theorem 4 can be found in Appendix B; here we provide a very brief sketch. Just 
as a Grover-like algorithm for standard search can be thought of as acting on a two dimensional 
subspace of the full A^-dimensional Hilbert space, a Grover-like algorithm for STO can be thought 
of as acting on a three-dimensional subspace. We create a progress function as a position of the 
state in this subspace such that G has no affect on the progress function, while O* and Os can 
cause the progress function to increase or decrease. We then show that the increase in the progress 
function due to one of the oracles, divided by the cost of that oracle, is bounded. In other words, 
for a given cost, we can only increase the progress function by a certain amount, no matter which 
oracle is used. We finally take the total change in the progress function necessary to achieve success, 
and divide by the change in progress per cost to put a lower bound the cost. 


5 Classical Cost Complexity of STO 

In this section, we give bounds on the classical randomized cost complexity {RGC) of STO. We 
will examine both the exact and bounded error cost complexity. For the exact cost complexity, we 
see that there are two classical algorithms that resemble Algorithm 1 and Algorithm 2, but whereas 
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in the quantum case, it is possible to do better with the Hybrid Algorithm, we prove that there 
is no classical counterpart to the Hybrid Algorithm. In the case of exact and bounded error cost 
complexity, we see a polynomial increase in cost compared to the quantum case. 

In the case of exact classical cost complexity, we have: 

Lemma 1. The exact (0-error) classical cost complexity of STO is 

RCCoiSTO) = mm{Nc^, {N - l)c 5 + McJ. (35) 

Proof. We consider an adversarial oracle that knows in advance the queries the algorithm will make. 

Recall that for i G [A^], fs identifies whether i G S and /* identifies whether i = i^. We say an 
item has been completely queried if it has been queried with / 5 , and is found to not be an element 
of S', or if it has been queried with /*. Then the adversarial oracle acts in the following way: 

• The first M — 1 items that the algorithm queries using oracle fs are all elements of S. 

• If all elements except one have been queried (but not necessarily completely queried) using 
either function /* or fs, the final element to be queried will be an element of S (even if this 
element is not queried using fs). 

• The last element to be completely queried is the marked item, if it exists. 

Any algorithm acting against this adversarial oracle that makes q queries using fs, has worst- 
case cost at least 

Ncs-\-Mc^: \iq = N, 

qcs -I- [{N — q) -\- (M — l)]c* ifA^—l>g>M — 1, 

qcs -I- Nc^ if M — 1 > (7 > 0. (36) 

These expressions are minimized at q = N — 1 or q = 0, and we obtain 

RCCoiSTO) > mm{Nc^, {N - l)c 5 + McJ. (37) 

For the upper bound, consider the following two algorithms. 

Algorithm 4. Query all items using /*. This algorithm will find the marked item if it exists with 
certainty, and has cost Ac*. 

Algorithm 5. Query all but the last item using fs. Then: 

• If M items of S have been found, query /* on these M items. 

• If M — 1 items of S have been found, query /* on these M — 1 items, and also the last item 
(the item that was not queried using fs). 

• Otherwise \S\ ^ M and therefore no marked item exists. 

This algorithm will find the marked item if it exists with certainty, and has cost (A — l)c 5 -|- Me*. 
Thus we have 


RCCoiSTO) < min{Ac*, (A - l)c5 + Me*}. 


(38) 

□ 
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Algorithm 1 can be thought of as the quantum version of Algorithm 4, while Algorithm 2 can 
be thought of as the quantum version of Algorithm 5. In the 0-error classical case, these two 
approaches tell the whole story. However, in the quantum case, you can do better with the Hybrid 
Algorithm. The Hybrid Algorithm works by doing something very quantum, which is to partially 
search for the elements of S. In the classical case, this doesn’t work. Once you’ve found an element 
of S, you’ve found it; there is no way to partially find an element of S. 

With Lemma 1, we’ve proven that in the 0-error case, we can obtain a polynomial reduction in 
cost by using a quantum algorithm for STO. Next, we show this polynomial reduction holds even 
in the case of bounded error algorithms. We do this by reducing STO to the problem of SEARCH. 
Recall that for SEARCH, we have: 

Lemma 2. Any randomized classical algorithm that solves SEARCH with bounded probability must 
query /* at least 0.(N) times. 

Now we can prove the reduction of STO to standard search: 

Lemma 3. Any randomized classical algorithm that solves STO with bounded probability of error 
must use as least 0,{N) queries to either /* or fg, as long as M/N < 1/9. 

Proof. Suppose there is a randomized algorithm A that solves STO with probability 3/4 and makes 
g* queries to /* and qg queries to fg. Then we will use A to find L in the case when we are given /* 
but not fg. To do this, we will use /* to create a function that behaves similarly to fg. We choose 
a subset T £ [N] with |T| = M — 1 at random, and create a function fx that acts as 


hii) 


1 if i G T 
0 if i ^ T. 


Then we create the function fg to simulate fg, where 

fsil) = frii) V /*(i). 


(39) 


(40) 


Each time we want to query fg, we must query /*(i). Notice that fg behaves like a valid fg function 
unless z* exists and i^: € T (because in this case fg marks M — 1 items instead of M.) i^: € T with 
probability 

We create fg as above, and we implement A, but every time A asks us to apply fg, we instead 
apply fg. This new algorithm will succeed with probability 3/4(1 — (M — l)/N) >2/3, because 
it succeeds with probability 3/4 as long as L ^ J-. This means we have created an algorithm for 
standard search which uses g* -|- qg queries to /* and which succeeds with probability 2/3. But by 
Lemma 2, we must have q* + qg = H(N). □ 

Finally, we note that there is an additional restriction on the number of queries to /*: 

Lemma 4. Any randomized classical algorithm that solves STO with bounded probability must use 
at least H(M) queries to /*. 

Proof. Suppose the elements of the subset S were known. Then in the worst case, that would still 
only narrow down the search to M items. (This is the worst case because if l^l A then one 
immediately knows there is no marked item.) One must then perform a search for one marked item 
out of M, which requires H(M) queries via Lemma 2. □ 

Now we can state our lower bound on the query cost of STO: 
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Theorem 5. The bounded error elassieal randomized eost eomplexity of STO is 

RCC{STO) =min{Q(csiV + c*M),J7(c*iV)}. (41) 

Proof. When M/N < 1/9, we solve the following linear program: 

minimize: + qscs 

subject to: g* > /i(M, e) 

q, + qs>f 2 {N,M,e). (42) 

When M/N > 1/9, from Lemma 4, we have have g* = Q(M) = fl(A^), so the cost is as least 
n{c^M) =n{c^N). □ 

Comparing Eq. (41) with Eq. (20), we see that there is always a separation between the 

quantum and classical costs of STO. In particular, to get the quantum scaling from the classical 
scaling, simply replace all M’s and A^’s by \/M and \/]V- 


6 Conclusions and Open Questions 

While query complexity is a well understood and powerful tool for quantifying the power of quantum 
computers, there are still problems that are not easily characterized by query complexity. Cost 
complexity is one way of extending the standard query model, and we’ve argued that this approach 
has potential applications in constraint satisfaction problems. 

While we motivated STO with problems like A:-SAT, graph isomorphism, and the traveling 
salesman problem, it is not obvious how much of a speed-up an STO inspired algorithm for these 
problems would be. The speed-up in STO depends critically on N, M, c*, and Cg. It would be 
interesting to calculate approximately what this relationship is, for example, in a random /c-SAT 
instance. Once this relationship is better understood, we could determine the amount of speed-up 
an STO algorithm would give for such a problem. However, even with a better understanding of 
this relationship, it is unlikely that M would be known exactly. In that case, a method such as 
fixed point search [16] might be helpful. 

STO is a very simple extension of a search problem, and thus the methods described here all 
have a Grover-ish flavor to them. It would be interesting to find well motivated problems for the 
cost complexity model where other quantum algorithms could be employed. 

We have also left open the question of the exact cost of STO. We believe our algorithm is 
optimal, but it seems new techniques are needed to prove it. 
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A Analysis of the Hybrid Algorithm 

Throughout this section, when we are calculating something “to zeroth order”, we drop terms whose 

sizes are or 0((M/N)^/^) multiplied by the size of the largest term. 
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In Section 3, Eq. (24), we showed that the cost of the Hybrid Algorithm is 


Cost (Hybrid) = 


arcsin y/1 — e — arcsin “ 


^/M 


2 arcsin 


/I—a 
y/M 


( 


c* + 2 c5 


V 


arcsin yjl — a — arcsin y ^ 
2 arcsin W ^ 


( 43 ) 


In this appendix, we prove that in the limit of M —)■ oo and N/M —)■ oo, there is a choice of a such 
that the cost is 


n C 5 \/]Varcsin Vl - e 

Cost (Hybrid) =---sec (popt + \/ ^ 


M 

iv 


(44) 


where cpopt is given by 


= max 


(j) : tan [ (j) + ^/^) 


We first define 


t = 


arcsin — a — arcsin W ^ 


2 arcsin J ^ 


so t is a non-negative integer. Substituting t for a in Eq. (43), we obtain 
Cost(Hybrid) ={2tcs + c*) 


arcsin 


\/r^ 


2 arcsin 


^sin ^(2t -|- 1) arcsin ^ 


-1 


\fM 


- 1/2 


To zeroth order, this becomes 


Cost (Hybrid) = 


{2tcs + c^)VM arcsin y/1 — 


2sin (2t + l)Cf 


Einally, we denote cp = 2t\/M/N to obtain 


Cost (Hybrid) = 


4>cs + arcsin vT 

2 sin ((p + \[^ 


— e 


(45) 


(46) 


(47) 


(48) 


(49) 


We take the partial derivative of the cost with respect to (p, and set it to zero to find the value 
of (p that gives the smallest cost. We find the cost is minimized when (p = (popt, where (popt satisfies 


tan ((popt + \/m/n] = (popt + —^M/N. 


(50) 


17 



































Notice that there is always a solution with cpopt G [—-v/M/N", vr/2]. However t is non-negative, so if 
<popt < 0 we set (l)opt = 0. This condition, along with Eq. (49) and Eq. (50), immediately gives the 
cost claimed in Eq. (44). 

We might not be able to exactly attain this cost, because t must be an integer, so we might 
only be able to set cj) close to (popt- We show that even if we can’t set (p exactly to (popt, we can still 
attain the cost of Eq. (44), to zeroth order. 

There are two cases to consider. In the first case, we assume < popt < vr/2. We 

require that t be a non-negative integer, so we choose t = (poptV^) /{2^/M) , and hence we set 



(51) 


Eor that choice, notice that 


P-Popt = o[{M/N)^/^). (52) 

This allows us to relate terms involving p to those involving Pq: 

sin (^p + ^Jm/N^ =sin (^Popt + \Im/N^ ± 0{{M/nY/^) 

= sin [popt + ^[M|N^ (l ± 0{{M/Nf/^)) 

= {popt + cos (^Popt + ^/m/N^ (l ± O ((M/Ar)V4^) 

= cos [popt + 4^^ (l ± O ({M/Nf/^) , (53) 

where in the first line, we use the angle addition formula and Eq. (52); in the second, we use the 
assumption that popt > (M/A^)^/^; in the third line we applied Eq. (50); and in the last we have 
used Eq. (52) and the assumption on the size of popt- Plugging Eq. (53) into our expression for 
the cost in Eq. (49), we have that to zeroth order, we obtain Eq. (44), as desired. 

We now consider the second case, when 0 < popt < In this case, we simply set t = 0, 

and hence p = 0. Plugging p = 0 the cost of Eq. (49), we have, to zeroth order. 


Cost(Hybrid) 


arcsin 

2 



(54) 


We will show that Eq. (54) and Eq. (44) are equivalent for 0 < popt < (M/iV)^/^. We have 


sec (^Popt + ^M/N^ =1 + 0 . (55) 

We can expand Eq. (50) to get 

cs = c*(l-0((M/iV)V4))). (56) 

Plugging Eqs. (55) and (56) into Eq. (44) and keeping only zeroth order terms, we recover Eq. 
(54). 
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B Proof of Theorem 4 


In this section, we prove the following theorem: 

Theorem 4 (Exact Lower Bound). The cost of every Grover-like algorithm for STO that succeeds 
with probability at least 1 — e for a constant e is at least 


csVN arcsin y/1 — 


sec ((i)opt + \Jm/n] , 


where (fopt satisfies 


fiopt = max 


0 , 

: tan (</>+ \/^') = 


We also require the conditions M,N/M —)• oo and C —)■ 0, where 

C = 


c^y/e2M cos [fiopt + 


(32) 


(33) 


(34) 


Proof. Throughout this section, when we say to zeroth order, we mean dropping terms of size at 
most or O [{M or 0{C) of the zeroth order terms. 

Since we only consider the operations Og, O*, and G, the state of the system never leaves the 
three-dimensional space spanned by the orthonormal states 

I ) = v^M-l = y'N-M '^i^S K) }■ (57) 

It turns out that it is more convenient to work in a slightly shifted basis from that of Eq. (57). 
We instead use the orthonormal basis states: 


\x) = cos 9o\ifi) — sin 9o\S~), 

|y) = cos (po sin 0 o|l) + cos (po cos 9o\S~) — sin (()o|S'“''), 

\z) = sin (pQ sin 0o|G) + cos 9q sin (/)o|5“) -|- cos (/>o|S'"'') 

= \N). (58) 

We can think of these states as forming the axes of a 3-dimensional space, where a state 

\x) = x\x) + y\y) + z\z) (59) 

is identified with the point {x,y,z). Then if the algorithm is initialized in the equal superposition 
state Iz), the goal of the algorithm is to move from the |z)-axis towards the |x)-axis. 

Since any normalized state of the system corresponds to a point on the unit sphere in this space, 
let us now introduce polar coordinates, with the |x)-axis as the polar axis. Specifically, we associate 
the state |x) with the polar coordinates {9,(p), where 

x = sm9, y = cos9sm(p, z = cos 9 cos cp (60) 

for 9 G [—7r/2,7r/2]. (The variable cp in this section plays a nearly identical role to cp in Appendix 
A, so we use the same variable name.) 
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If we multiply a state by —1, this transforms the coordinates from (0, (p) to (—0, 4> + 7r). Because 
overall phases do not affect the state, we can apply this transformation for free. In particular, we 
use it to “pick a gauge” and choose the coordinates that satisfy 0 > 0. 

For a Grover-like algorithm which finds the marked state with high success probability, the 
algorithm starts at the point (0 = 0,0 = 0), and must end near 0 = 7r/2. We define a progress 
function H{9, 0), for 0 > 0, as 


H(9, (p) = 9 — kvaiD. 0 -|- 2£7r — 7r/2 , 

(61) 

k — Oq COs(^opt “1“ 0o)? 

(62) 

00 = arcsin M/N ^ 

(63) 

00 = arcsin 1/M, 

(64) 

(pcmt = max < 

(0 : tan(0 0o) = 0 -h ^0o. 

(65) 


The second term of H{6, 0) is proportional to the angular distance of 0 to 7r/2 (taken so the distance 
is < vr). 

Before we analyze how each unitary changes the progress function, we will look at the total 
progress that must occur for the algorithm to succeed. The total progress gained by the algorithm 
must be larger than the difference between the value of the progress function at the starting point 
and the end point. We pick the starting point as the last time the algorithm increases 0 from less 
than 200 to more than 20o, and 0 > 0. (We require 0 > 0 for Lemma 5, and we require 0 > 20o in 
order to calculate the progress due to O^.) We will show later that such a point will always exist 
for any successful algorithm, and also that at such a point 0 < 60o. Thus the value of the progress 
function at the starting point is at most 60o. 

For the end point of the algorithm, note that the probability of success is 

sin^(0) > 1 — e, (66) 


to zeroth order. Thus the total change in progress function is at least 

arcsin \/l — e — kir — 60o > arcsin Vl — e — (6 -|- 7r)0o, (67) 

where we bound k using Eq. (62), and the fcvr term comes from the worst possible value of 0 when 
0 gets sufficiently large. 

We note the following: from Eq. (25) and Eq. (62) we see that the cost of the optimal algorithm 
is at most 


cs arcsin Vl — e 

00 fc 


( 68 ) 


and from Eq. (67) the change in the progress function is at least arcsin (6-|-7r)0o; therefore 

the progress per unit cost must be at least (pok/cs, to zeroth order. It therefore follows that 
when calculating the change in progress function, we only need to keep track of terms up to order 
O{(pok/cs) per cost. Eor example, for O*, we need only keep track of the change in progress (not 
progress per cost) up to order O{(pokc^/cs)- 

The change in the progress function H{6, 0) due to the unitaries G, Os, and O* can be calculated 
by how they change the coordinates (0, 0) of a state. After some algebra and using our gauge choice, 
we obtain 
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• G'. The unitary G is a reflection about the z-axis, and in polar coordinates is the map 


G : {e,cj)) (0,7r- 4>). (69) 

Comparing with Eq. (61), we see G has no effect on the progress function. 

• Os'- The oracle Os is a reflection about the state with has polar coordinates (0 = 0, (/> = — ^o). 

C>5 : (0, (/>)-)> (0, TT-(/)-20o) (70) 

We see that Os can change the progress function by at most 2(pQk. Thus the increase in the 
progress function per cost due to Os is at most 

2(j)Qk _ 2(^o^o cos((^opt T 4^q) (71) 

cs cs 

• O*: The oracle O* is a reflection about the state |i*), which is close to |a:). We find O* 
transforms coordinates as 


0 —>■ 0 + 200 sin((/> + (po) + 0{9q) 

4> ^ TT + 4 > + o ■ 

Vcos 0 / 


(72) 

(73) 


Now we consider how O* affects the progress function; unlike the previous cases, which we 
calculated exactly, we will only analyze this case to zeroth order. We will first show that we 
can assume \(j)\ < 7r/2. Suppose that \<p\ > 7r/2 just before we would like to apply O*. Then 
instead of applying O*, we apply GO^G. One can check that with this replacement, when O^ is 
applied, \(j)\ < 7r/2. Furthermore one can verify that this replacement causes 0 to increase (which 
can only be good for the progress function), while on the other hand, the value of 4> changes by 
at most O (0o/ cos 0) due to this replacement, resulting in a change in the progress function of size 
O (/c0o/\/e) (using Eq. (66) to bound cos 0). Using our assumption that that C = o(l), this change 
has order less than 0{(j)okc^/cs), and so can be discarded using the argument following Eq. (68). 
We can therefore assume that O* is always applied at \(j)\ < 7r/2. 

Now we can examine the change in the progress function due to the action of O*. The increase 
in the progress function is 


200 sin((/> + (j)o) + 0 ( 00 ^ 

— k fmin \ — 6 + 2£7r — 7r/2| — min \(b + 2£7r — vr/2|^ + O (^ 
Vtez tez ' 7 Vcos0 


Since |(^| < 7r/2, the increase in the progress function due to O* is less than 


200 sin((/) + Pq) - 2(f)6o cos{(j)opt + po) + O 



(74) 


(75) 


where we have used the value of k from Eq. (62) and bounded cos0 with Eq. (66). 

Taking the first and second derivatives of Eq. (75) with respect to p, we see that when > 0, 
the increase in the progress function is maximized when p = popt- It turns out that if one applies 
O* at (/> < 0, it is sometimes possible to achieve a larger increase in progress per cost than when 
p >0. However, we show at the end of this section, (Lemma 5), that applying O^ when p < 0 will 


21 






always be less efficient (up to higher order terms) in terms of the increase in progress function per 
cost, than applying O* at (/> = when viewed in the context of the larger algorithm. Applying 
the definition of from Eq. (65) to Eq. (75), and using the definition of C from Eq. (34), the 
increase in the progress function due to O* is less than 

COs(jiopt + 0o) /^ ^ ^ ^ ^ 

C5 V / 

where the 0(</)o) term accounts for the case that (popt = 0. 

From Eq. (71) and Eq. (76) we see that (to zeroth order) the maximum increase in the progress 
function per cost is the same whether O* is applied or Os is applied. Dividing the total necessary 
change in progress (Eq. (67)) by the maximum change in progress per cost (Eq. (76)) gives us the 
minimum cost: 

In the limit of At, M —?■ oo and (7 —)■ 0, (to zeroth order) we have that the cost is at least 


f- - csVM 

arcsm V1 — e —- —-, 

2(^0 COs(^opt -|- (pQ) 


(78) 


which matches the cost of Eq. (25). 

We now justify why the value of the progress function must be less than 60q when we start 
tracking it. Immediately before we start tracking the progress function, we have 9 < 26q, so the 
bound on the increase in progress given by Eq. (75) does not necessarily apply. However, it is 
simple to show that the increase in the progress function due to O* is always bounded by 29o, 
where we have dropped terms of O(0o/\/e) as before. Thus if 0 < 26q, and then O* is applied, 6 
can increase by at most 26o, and so the new value of 9 satisfies 9 < 40o- At this point, 9 > 29q, 
but 4> might be negative. Notice that 9 can not increase unless O* is applied, (and 9 must increase 
in order to obtain a high probability of success) but O* flips the sign of </>, so after applying O* at 
most one more time, we will have both the conditions 9 > 29o and 4> > 0 satisfied, at which point 
we start tracking the progress function. This tells us that the value of 9 will be at most 69q when 
we start tracking the progress function. □ 


Lemma 5. Suppose there is an algorithm than applies O* when p < 0. Then there is always an 
alternative algorithm that aehieves the same or greater inerease in progress for the same or less 
eost (up to zeroth order), hut applies O* only when (/> > 0. 

Proof. We begin by classifying the the possible sequences of O*, Os, and G the algorithm can take. 
We will use notation such that unitaries act from right to left, so GO* signifies O* acts first, and 
then G acts. 

First look at O*. We can always assume O* is followed by a G; if it is not, insert a GG pair 
after the O*. Note in the discussion following Eq. (73), we proved that we can assume \p\ < 7r/2 
before applying O*. With Eqs. (69) and (73) we have 


GO,:P^-P + o(-^). (79) 

Vcos 9) 

Since \p\ < '^ before GO* acts, we also have |(/>| < | after GO* acts, up to an additive factor of 
O , which we can ignore thanks to the discussion following Eq. (68). Therefore GO* maps p 

inside the \p\ < ^ region. 
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Figure 3: The path in the figure at left uses a sequence (GO 5 )™' to move from (j)start to 4>end, 
whereas the path in figure at right uses a sequence G{OsG)^. The path using (GO 5 )™' is shorter, 
signifying that fewer uses of Os are required to move from 4>start to (pend, and thus this is the more 
efficient path. 


In between applications of GO*, there is always a sequence of one of the following forms: 

{GOsr, G{GOsr, {OsGr, or G{OsGr, ( 80 ) 

where m is a non-negative integer that indicates multiple applications of the unitary sequence inside 
the parenthesis. These are the only possible sequences because O 5 O 5 = I and GG = I. Combining 
the action of G and Os in Eqs. (69) and (70) we get 

{OsGr ■.{e,<P)^{e,<P-2m(Po) ( 81 ) 

{GOsr-{0,4>)^{0,4> + 2m(Po)- (82) 

Thus the 4 sequences of Eq. (80) rotate (p by some amount ±2m<po, possibly followed by the 
transformation p ^ tt — (p. 

Now we focus on the algorithm’s action on p. Since the GOOs are mapping p between points 
inside the |</>| < | region, the four possible sequences of alternating G and Os in Eq (80) just 
connect the value of p after applying GO* to the value of p before the next application of GO*. 
Generalizing Figure 3, one can see that the shortest path uses either (GO^)™’ or (OsG)™’ to connect 
points inside the \p\ < ^ region. Therefore we do not need to consider the sequences G{OsGr or 
G(G05)"*. 

Next, we show that if one initially has </> > 0, it is never advantageous to again apply GO* 
when p < 0. Since the algorithm must consist of applications of GO* separated by sequences of 
either {OsG)^ or (GOs)'", we can enumerate and address the three possible cases that lead us to 
apply O* at some p = pneg < 0 after initially having p > 0. The three possible cases are laid out 
graphically in Figure 4. In order to prove that none of the cases are optimal, we define the function 

p*(0) = 2(6»o sm{p -h po) - kp) (83) 

as the change in progress function due to an application of O*, dropping higher order terms. Note 
for (/> > 0, popt optimizes Eq. (83) as discussed after Eq. (75). We proceed to treat the three cases. 

Sequence I. We consider the following sequence of operations (see Eigure 4): 
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(i) Start with (/)j > 0. Then apply GO* to get to —4>i. 

(ii) Apply (GOs) some number of times to increase (f> to 4>neg > —(pi- 

(iii) Apply GO* to get to -(pneg < (pi- 

The change in progress due only to O* in this sequence is 
P*{(pi) +P*{(pneg) = 2(00 sin((/)i + (po) - k(pi) 

T 2(00 sin((^^eg T (po) kcpfieg) 

^ A\n - f(pi~k (pneg , / \ i (pneg + (pi i 

< 4[0osm(-^^ + <po) - k - ^ -] 

= 2p*((^j T (pneg) 

< 2p^{(popt), (84) 

Since (pneg + 02 > 0, the average progress due to the two applications of O* is 
worse than if we had applied O* at (popt both times. Thus this sequence cannot 
be optimal. 

Sequence II. We consider the following sequence of operations (see Figure 4): 

(i) Start with (pi > 0. Then apply GO* to get to —(pi. 

(ii) Apply (O 5 G) some number of times to decrease (p to (pneg < —<Pi- 

(iii) Apply GO* to get to -(pneg > 4>i- 

Compare Sequence II to the following Sequence 2: 

(a) Start with (pi > 0. Then apply (GO 5 ) some number of times to increase (p to 

(pneg ^ (pi- 

The difference in progress between Sequence II and Sequence 2 is 

(200 sin( 0 j + 0 o) + 200 sin( 0 neg + (po)) 

=400 sm(-^^ + 0o) cos(-^-^) 

<400 sin 00 ) (85) 

since — f < < 0 and 0 < Sequence II and Sequence 2 both 

use the same number of applications of O 5 (in steps (ii) and (a) respectively). 
Therefore, the Sequence II has an additional cost 2c* while it only has an added 
increase in progress of 

400 sin 00 = 2 p*( 0 ) 

< 2 p*( 0 opt). ( 86 ) 

Therefore Sequence II does not attain the increase in progress per cost that one 
could attain by only applying G* at (popt- 

Sequence III. We consider the following sequence of operations (see Figure 4): 

(i) Start with 0* > 0, then apply (O 5 G) some number of times to decrease 0 to 

(pneg ^ 0. 
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(ii) Apply GO* to get to -(l)neg- 
Compare Sequence III to the following Sequence 3: 

(a) Start with (pi > 0, and then apply {OgG) some number of times to decrease 
p to such that 2pQ >(/)«,> 0. 

(b) Apply GO* to get to —pw 

(c) Apply (GOs) some number of times to increase p to —pneg > 0. 

Note that we can always create a sequence with such a py, because (OsG) changes 
p by at most 2pQ each time. The cost of Sequence III is the same as the cost of 
Sequence 3. The difference in progress between Sequence III and Sequence 3 is 

26»o SUl{pneg + Po) “ 26q sm{py, + Po) 

^ AO ( T pw , I \ • ('Pneg ~ Pw \ 

<46»ocos ( - ^ - hpoj sm ( - ^ - 1 

<0 (87) 



Figure 4: Possible paths that could lead to applying GO* at a negative value of p, when initially, 
p has positive value. 
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since | <t>neg+<l>w _|_ <; | ^nd | < < 0. Therefore Sequence III is not 

optimal either. 

Hence we conclude that applying O* at negative cf) never achieves as much increase in progress 
per cost as applying O* at 4>opt, and therefore we only need to consider applying O* at positive (/>, 
at 4>opt • n 


C An Adversary Lower Bound 


In this section, we will show how to apply the adversary method to the problem of cost complexity 
of STO. 

Suppose we are given access to an oracle O*, which implements the function /*, and an oracle 
Os, which implements the function fs- Then any algorithm which solves STO using these oracles, 
after t steps, produces a state 

l^/.Js) = (88) 

where Cj E {*,5}, and are fixed unitaries independent of /* and fs- 

We create an adversary matrix T, a matrix whose rows and columns are indexed by pairs of 
functions {f*, fs) G -C^STO; where Dsto is the set of valid inputs to STO. Furthermore, we have 
the condition that that r[(/*,/ 5 ), {g*,gs)] = 0 if ST 0 (/*,/ 5 ) = STO(( 7 *, 5 ( 5 ). With this notation, 
we define the progress function: 

(/*i/s)i(5*i9s)Si3sTOX^STO 

for a vector v indexed by the elements of D^to, such that ||?;|| = 1 and v is an eigenvector of T 
with eigenvalue ±||r||, (where || • || signifies the 1-2 norm for vectors or the induced 1-2 norm for 
matrices). 

Then following [12]^, we have 

1. wo = ||r||. 

2 . < {2yJe{l — e) + 2 e^ ||r||, for any algorithm with probability of error at most e. 

3. W*'~^ — < 2maxi ||r o Df\\ where Df are |T)stoI l-^STol niatrices satisfying 


D*[{f*,fs),{g*,gs)] 


0 if /*(z) = g^{i), 
1 otherwise. 


Df[{f*,fs),{g*,gs)] 


0 if fs{i) = fs{i), 
1 otherwise. 


Thus if g* queries are made to O* and qs queries are made to Os, we have 

||r 115 (e) < 5 * max ||r o D*\\ + 55 max ||r o Df\\ (90) 

i i 

where 

l-(2y^(r^ + 2e) 

g{e) = —^^( 91 ) 

We construct the following adversary matrix for STO: ^[{f*, fs), {g*, gs)] = 1 if one of the 
following conditions holds: 

^The proofs are identical, so we omit them. 
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• STO(/*,/s) = 1, STO{g^,gs) = 0, and fs{i) = gs{i) except if = 1, then gs{i*) = 0, 

• STO{g^,gs) = 1, STO(/*,/s) = 0, and gs{i) = fs{i) except if g^{i*) = 1, then fs{i*) = 0. 
Otherwise, F = 0. 

One can calculate (or it is easy to see by analogy to a standard Grover search over N — M + 1 
items) that 

||r|| = VN-M + i, 

max ||r o Z)F II = 1, 

i 


max r o DfW = 1. 
i 

(92) 

Plugging into Eq. (90) we have 


g{e)VN - M + 1 <q^: +qg, 

(93) 

so for N > M/2, we have 


QCC(STO) = n{csVN). 

(94) 

We also consider a second adversary matrix for STO. Let r[(/*,/s), {g*,gs)] 

= 1 if one of the 


following conditions holds: 

• STO(/*,/s) = 1, STO{g^,gs) = 0, and fs{i) = gs{i), 

• STO{g^,gs) = 1, STO(/*,/s) = 0, and gs{i) = fs{i). 

Otherwise, T = 0. 

In this case, the adversary matrix only pairs instances such that Os is the same in both pairs. 
Thus it is as if the set S is known ahead of time. In this case, one can calculate (or it is easy to 
see by analogy to a standard Grover search over M items), that 

||r|| = ^/M 

max ||r o || = 1 

i 

max ||r o II = 0. (95) 

i 

Plugging into Eq. (90), we have 

g{e)'/M < q^, (96) 

so 

QCC(STO) = n{c^VM) (97) 

Gombining Eq. (94) and Eq. (97), we obtain a bound that matches Eq. (20): 

QCC(STO) = n (max{c*\/M, C 5 \/iV}) . (98) 
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